CVE-2017-16362 Memory corruption in Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Out-of-bounds read in Adobe Acrobat Reader's MakeAccesible plugin allows attackers to execute code or leak information via crafted font data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-16362?
CVE-2017-16362 is a high-severity memory corruption vulnerability in Adobe Acrobat, published on 9 Dec 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of an out of bounds read vulnerability in the MakeAccesible plugin, when handling font data. It causes an out of bounds memory access, which sometimes triggers an access violation exception. Attackers can exploit the vulnerability by using the out of bounds access for unintended reads, writes, or frees, potentially leading to code corruption, control-flow hijack, or an information leak attack.
Weakness: CWE-125
Which versions are affected by CVE-2017-16362?
It affects 4 products.
Products include Adobe Acrobat, Adobe Acrobat Dc, Adobe Acrobat Reader, Adobe Acrobat Reader Dc.
How do I fix CVE-2017-16362?
No fix has been published for CVE-2017-16362 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-16362 being exploited?
There is no known exploitation of CVE-2017-16362 in the wild and no public exploit code.
Other vulnerabilities in Adobe Acrobat
Sources
Also known as GHSA-fhhf-9j5g-c4px.